Abstract:In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

An Event Based Detection of Internal Threat to Information System

Text Classification and Threat Intelligence Generation for Industrial Control System Security

A Directed Acyclic Graph Based Detection for Rbac Based Secure Interoperation

Network Security Situation Awareness for Industrial Control System under Integrity Attacks

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

Dynamical System approach to insider threat detection

An online intrusion detection method for industrial control systems based on extended belief rule base

BLITHE: Behavior Rule-Based Insider Threat Detection for Smart Grid

Threat Detection in Trigger-Action Programming Rules of Smart Home With Heterogeneous Information Network Model

An approach to internal threats detection based on sentiment analysis and network analysis

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

Model Based Analysis of Insider Threats

An Intrusion Detection Method for Industrial Control System against Stealthy Attack

An integrated pattern recognition approach for intrusion detection

Detecting PLC Intrusions Using Control Invariants

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

Research and application of internal malicious code threat detection system

A insider threat detection system based on user and entity behavior analysis

Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning